I just bought an EPM-441A (same as the E4418A, I believe, just with a different part number), and the video was helpful in the disassembly. It's nice to see parts taken apart before trying to take them apart myself. The E4418B also seems nearly identical to the E4418A, just with a few extra IO ports on the back.
Mine, being an older unit, had the old A.01.10 "DSP firmware". A newer version was required to update the firmware to the newest revision. The upgrade kit has been discontinued, but thankfully I was able to find the new firmware on KO4BB. It's stored on an Intel AM28F512-150JCL flash IC. That flash IC is also discontinued, and there is no modern replacement. I risked by unit by erasing it and reflashing the new firmware (using a TL866). I initially had some trouble reading the existing code. I was getting empty blocks during the reads. After about four tries, the old firmware seemed to have been read successfully. I don't know if the flash was too old and it was having trouble reading it, or if there was an error in the TL866. But eventually, it worked! I was then able to update the system's main firmware. I don't know for sure, but I feel like the zeroing is a little bit better now with the updates.
Here's something I've been wondering... Why do some sensors that end in the same connector type have a longer bulkhead assembly than others? Your disassembly shows that it's just a coaxial design through the multiple pieces.
Is there an RF reason?
I've noticed this on high-power sensors. I believe that the long section is an attenuator, though I could be wrong....